Magniber Ransomware Campaign Targets Home Users using JavaScript

A new campaign is targeting home users using impersonated software updates leveraging JavaScript to deliver the Magniber Ransomware.

Context

On October 13, 2022, HP security researchers reported the technical details of a current campaign leveraging JavaScript files impersonating legitimate Windows Security updates to infect home users with the single-client Magniber ransomware.

Technical Details

HP researchers assessed that:

• Home users were the likely target of this malware based on the supported operating system versions and UAC bypass.
• The attackers used clever techniques to evade protection and detection mechanisms. Most of the infection chain is “fileless”, meaning the malware only resides in memory, reducing the chances of it being detected.
• Magniber also bypasses detection techniques that rely on user-mode hooks because it uses syscalls instead of standard Windows API libraries.
• With the UAC bypass, the malware deletes the infected system’s shadow copy files and disables backup and recovery features, preventing the victim from recovering their data using Windows tools.

Mitigation Options

HP researchers provided the following defensive recommendations:

• Follow the principle of least privilege by only using administrator accounts if you really need to. Many home users have administrator privileges but rarely need them.
• Download software updates from trusted sources. The campaign depends on tricking people into opening fake software updates. Only download updates from trustworthy sources such as Windows Update and official software vendor websites.
• Back up your data regularly. Backing up your data will give you peace of mind should the worst happen.

IOCs

HP researchers provided the following indicators of compromise (IOCs):